EndpointsAuthenticationAuthCapabilities
Inspect the authenticated token's available scopes
The API runs on your application instance. Schemas and field names come directly from the OpenAPI specification. Session-authenticated requests require a session on that instance.
GET
bearerAuthheader
AuthorizationBearer <inv_ token>X-Organization-ID?stringOrganization membership selected for this request. User-bound credentials may select any active membership; standalone tokens may only repeat their pinned organization ID.
Format
uuidToken identity and capabilities
application/json- response
name*stringprincipal*stringOpaque organization-scoped principal identifier for binding durable client state.
scopes*array<>role*|Stable role key for user-bound identities; null for standalone API tokens.
Match
^[a-z][a-z0-9_-]{0,63}$roleName*|Human-readable role name for user-bound identities; null for standalone API tokens.
permissions*array<>Granular workspace-wide permissions available through this token.
organization*organizations*array<>curl -X GET 'https://inventory.example.com/api/v1/auth/capabilities'Example Response
{ "name": "string", "principal": "string", "scopes": [ "read" ], "role": "string", "roleName": "string", "permissions": [ "inventory.read" ], "organization": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "slug": "string", "role": "string", "roleName": "string", "isReadOnly": true, "allowNegativeStock": true, "canManage": true }, "organizations": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "slug": "string", "role": "string", "roleName": "string", "isReadOnly": true, "allowNegativeStock": true, "canManage": true } ]}